PCI Compliance, Credit Card Security and E-Commerce Solutions
Businesses, or their web designers, looking at adding an online storefront or shopping cart to their website may not be aware of regulations governing the security of credit card transactions, and the penalties for noncompliance.
The regulations, known as the Payment Card Industry Data Security Standard, or PCI-DSS, were established by the Payment Card Industry to ensure that all companies that process, store or transmit credit card information maintain a secure environment.
Businesses may be held liable for breaches in security and penalties for noncompliance can range from a few dollars per month up to $5,000 to $100,000 per month.
So how does a small or medium business determine the best e-commerce solution to protect their customers from credit card fraud and identity theft and at the same time protect themselves from liability? The following is a brief overview of several PCI-DSS compliant e-commerce solutions.
Let PayPal Do It PayPal is one of the most popular ways to pay for something online and for small businesses it offers a straightforward solution to the problem of credit card security and PCI-DSS compliance.
By using the payments procedure known as PayPal's "Website Payments Standard", the payment processing portion of the e-commerce transaction is "outsourced" to PayPal's PCI compliant website.
Since all credit card transactions take place on PayPal's website, your business's website does not need to worry about PCI compliance.
The drawback of using PayPal's Website Payments Standard is that historically customers have gotten confused by the "jump" from the e-store to PayPal's website, leading to a significant percentage customers abandoning their shopping cart.
This has led businesses to try other solutions such as "Hosted Shopping Carts" or "Self Hosting" where the credit card transactions take place at your e-store.
The downside is now you have to deal with PCI-Compliance.
Hosted Shopping Carts PCI-DSS Compliant Shopping Cart hosting services are a good option for small businesses that do not want to deal with programming and maintenance of their shopping cart software.
With a hosting service you will not have to process or manage shopping cart or server software upgrades and the hosting service maintains PCI compliance.
The downside is that it may not be as customizable as other solutions.
Visa maintains an updated list of "validated service providers", some of which include: Amazon WebStore, 3dCart, CoreCommerce, Volusion and Go Daddy Quick Shopping Cart.
Self Hosting Self hosting is the most flexible e-commerce design solution.
With self hosting, you own the shopping cart and have the flexibility to modify it as needed.
However, you will be responsible for PCI compliance by keeping your shopping cart and content management software updated to the newest version to protect from SQL Injection hacks, and other security breaches.
You will also need to make quarterly PCI Security Compliance Scans.
If you do decide to self host, make sure your shopping cart is PA-DSS certified.
PA-DSS (Payment Application Data Security Standard) is the security standard for software vendors that develop payment applications, such as e-commerce shopping carts.
Currently there are 20 PA-DSS certified shopping carts.
One such cart is PDG Software.
PDG as well as being PA-DSS certified, is also an Intuit QuickBooks Gold developer, for those businesses looking for a QuickBooks e-commerce integrated solution.
In summary, for smaller businesses or businesses with only a few items to sell, PayPal is probably the most convenient solution.
A hosted shopping cart is probably best for businesses that need a larger store, but don't want to deal with software updates and maintenance issues.
Businesses that want the most flexibility and don't mind dealing with PCI compliance will most likely want to go with self hosting.
For more information on PCI compliance, see: https://www.
pcisecuritystandards.
org/index.
php
The regulations, known as the Payment Card Industry Data Security Standard, or PCI-DSS, were established by the Payment Card Industry to ensure that all companies that process, store or transmit credit card information maintain a secure environment.
Businesses may be held liable for breaches in security and penalties for noncompliance can range from a few dollars per month up to $5,000 to $100,000 per month.
So how does a small or medium business determine the best e-commerce solution to protect their customers from credit card fraud and identity theft and at the same time protect themselves from liability? The following is a brief overview of several PCI-DSS compliant e-commerce solutions.
Let PayPal Do It PayPal is one of the most popular ways to pay for something online and for small businesses it offers a straightforward solution to the problem of credit card security and PCI-DSS compliance.
By using the payments procedure known as PayPal's "Website Payments Standard", the payment processing portion of the e-commerce transaction is "outsourced" to PayPal's PCI compliant website.
Since all credit card transactions take place on PayPal's website, your business's website does not need to worry about PCI compliance.
The drawback of using PayPal's Website Payments Standard is that historically customers have gotten confused by the "jump" from the e-store to PayPal's website, leading to a significant percentage customers abandoning their shopping cart.
This has led businesses to try other solutions such as "Hosted Shopping Carts" or "Self Hosting" where the credit card transactions take place at your e-store.
The downside is now you have to deal with PCI-Compliance.
Hosted Shopping Carts PCI-DSS Compliant Shopping Cart hosting services are a good option for small businesses that do not want to deal with programming and maintenance of their shopping cart software.
With a hosting service you will not have to process or manage shopping cart or server software upgrades and the hosting service maintains PCI compliance.
The downside is that it may not be as customizable as other solutions.
Visa maintains an updated list of "validated service providers", some of which include: Amazon WebStore, 3dCart, CoreCommerce, Volusion and Go Daddy Quick Shopping Cart.
Self Hosting Self hosting is the most flexible e-commerce design solution.
With self hosting, you own the shopping cart and have the flexibility to modify it as needed.
However, you will be responsible for PCI compliance by keeping your shopping cart and content management software updated to the newest version to protect from SQL Injection hacks, and other security breaches.
You will also need to make quarterly PCI Security Compliance Scans.
If you do decide to self host, make sure your shopping cart is PA-DSS certified.
PA-DSS (Payment Application Data Security Standard) is the security standard for software vendors that develop payment applications, such as e-commerce shopping carts.
Currently there are 20 PA-DSS certified shopping carts.
One such cart is PDG Software.
PDG as well as being PA-DSS certified, is also an Intuit QuickBooks Gold developer, for those businesses looking for a QuickBooks e-commerce integrated solution.
In summary, for smaller businesses or businesses with only a few items to sell, PayPal is probably the most convenient solution.
A hosted shopping cart is probably best for businesses that need a larger store, but don't want to deal with software updates and maintenance issues.
Businesses that want the most flexibility and don't mind dealing with PCI compliance will most likely want to go with self hosting.
For more information on PCI compliance, see: https://www.
pcisecuritystandards.
org/index.
php
Source...